From: Mark Andrews <marka@isc.org>
Date: Thu, 23 Jun 2016 02:18:03 +0000 (+1000)
Subject: 4493.   [bug]           Address potential NULL pointer dereferences in
X-Git-Tag: v9.11.0b1~27
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=96d49a84fff54fe19b430c56912db0a55cf3ded8;p=thirdparty%2Fbind9.git

4493.   [bug]           Address potential NULL pointer dereferences in
                        dnstap code.
---

diff --git a/CHANGES b/CHANGES
index d42b2be2a3c..38ba75929c2 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4493.	[bug]		Address potential NULL pointer dereferences in
+			dnstap code.
+
 4492.	[func]		Collect statistics for RSSAC02v3 traffic-volume,
 			traffic-sizes and rcode-volume reporting. [RT #41475]
 
diff --git a/lib/dns/dnstap.c b/lib/dns/dnstap.c
index ab32f08e085..072735b3112 100644
--- a/lib/dns/dnstap.c
+++ b/lib/dns/dnstap.c
@@ -232,10 +232,11 @@ dns_dt_create(isc_mem_t *mctx, dns_dtmode_t mode, const char *path,
 		fstrm_writer_options_destroy(&fwopt);
 
 	if (result != ISC_R_SUCCESS) {
-		if (env->mctx != NULL)
-			isc_mem_detach(&env->mctx);
-		if (env != NULL)
+		if (env != NULL) {
+			if (env->mctx != NULL)
+				isc_mem_detach(&env->mctx);
 			isc_mem_put(mctx, env, sizeof(dns_dtenv_t));
+		}
 	}
 
 	return (result);
@@ -314,16 +315,11 @@ dns_dt_attach(dns_dtenv_t *source, dns_dtenv_t **destp) {
 }
 
 static void
-destroy(dns_dtenv_t **envp) {
-	dns_dtenv_t *env;
-
-	REQUIRE(envp != NULL && VALID_DTENV(*envp));
+destroy(dns_dtenv_t *env) {
 
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DNSTAP,
 		      DNS_LOGMODULE_DNSTAP, ISC_LOG_INFO,
 		      "closing dnstap");
-	env = *envp;
-
 	env->magic = 0;
 
 	fstrm_iothr_destroy(&env->iothr);
@@ -338,21 +334,21 @@ destroy(dns_dtenv_t **envp) {
 	}
 
 	isc_mem_putanddetach(&env->mctx, env, sizeof(*env));
-
-	*envp = NULL;
 }
 
 void
 dns_dt_detach(dns_dtenv_t **envp) {
 	unsigned int refs;
 	dns_dtenv_t *env = *envp;
-	REQUIRE(VALID_DTENV(env));
 
-	isc_refcount_decrement(&env->refcount, &refs);
-	if (refs == 0)
-		destroy(&env);
+	REQUIRE(envp != NULL && VALID_DTENV(*envp));
 
+	env = *envp;
 	*envp = NULL;
+
+	isc_refcount_decrement(&env->refcount, &refs);
+	if (refs == 0)
+		destroy(env);
 }
 
 static isc_result_t